Your Microsoft 365 MFA is enabled. Is it phishing-resistant?
"MFA enabled" is a status, not an answer. It does not tell you which users still depend on a text message, whether admin accounts are better protected than everyone else, or which exceptions quietly leave sign-ins exposed.
Issue 002 looked at firewall rules nobody owns. This issue looks at a different control that tends to be marked "done" and then left alone: multi-factor authentication in Microsoft 365.
Text-message and voice-call codes were a big step up from passwords alone. They are also the weakest MFA methods Microsoft offers. A code can be phished on a fake sign-in page and replayed within seconds, and phone numbers can be hijacked through SIM swapping. Microsoft is now moving Entra ID, the identity service behind Microsoft 365, toward passkeys, and it has set dates for retiring its own SMS and voice delivery.
According to Microsoft's published guidance, Microsoft-provided SMS and voice authentication retires on February 1, 2027 for most users, and on July 1, 2027 for Global Administrators and external users. After the applicable date, users whose only MFA method is SMS or voice must register a passkey at sign-in before they can continue. The timeline covers the public (commercial) cloud; Microsoft says other clouds will follow later. Organizations that still need SMS or voice can contract with a supported telephony provider through Microsoft Security Store instead. Check the current guidance for your tenant, because dates and details can change.
Five checks for this week
1. Inventory SMS and voice dependencies
Count the users who actually sign in with SMS or voice, not just the methods enabled in policy. Microsoft publishes a usage-analyzer script for this; any non-zero result means you are in scope. Pay special attention to users whose only registered method is a phone number: they are the ones who will hit a blocking prompt.
2. Verify policy coverage
Confirm how MFA is actually enforced: Security Defaults or Conditional Access. Look for legacy authentication still allowed, broad exclusion groups, and service accounts or shared mailboxes that were exempted years ago. Conditional Access requires Entra ID P1 licensing, so the right answer depends on what you own.
3. Protect privileged access first
Administrator accounts should be separate from daily-use accounts and should use phishing-resistant methods such as passkeys or FIDO2 security keys. Keep at least two emergency-access ("break-glass") accounts, document how they are protected, and test that they work.
4. Pilot enrollment and recovery
Before broad enforcement, enroll a pilot group across the device types your staff really use, including personal phones and shared workstations. Test the help-desk path for a lost or replaced phone. A rollout that locks out legitimate users on a Monday morning fails, however strong the method is.
5. Keep evidence
Track method usage over time, every exception and who approved it, owners for each remaining gap, and remediation dates. Cyber-insurance questionnaires, audits, and customer security reviews increasingly ask how MFA is enforced, not just whether it is on.
Who does what
Leadership decides how much disruption is acceptable, which exceptions the business will accept, and the deadline the organization is working to. The MSP or internal IT team runs the inventory, designs the policies, handles enrollment, and supports users. Both should agree on who owns each exception, because an exception nobody owns is how "temporary" becomes permanent.
Planning the change without locking people out
- Measure. Run the inventory and identify SMS-only and voice-only users.
- Decide. Choose the target methods (passkeys, Microsoft Authenticator, security keys) and decide whether any group genuinely needs SMS or voice through a third-party telephony provider.
- Pilot. Start with IT and a small cross-section of users. Fix device and recovery problems before expanding.
- Communicate. Tell users what will change, when, and how to get help, before the sign-in prompt does it for you.
- Enforce in waves. Move groups over in stages, with administrators moved early, not last.
- Review. Re-check usage and exceptions after each wave, and again before each Microsoft deadline.
A useful first step needs no project at all. Ask your MSP or IT team: how many active users still depend on SMS or voice, and who owns the migration plan?
Source: Microsoft Learn: Microsoft-provided SMS and voice retirement FAQ. Dates, scope, and licensing requirements may vary by tenant and cloud.
VALO Security Brief is published every other Wednesday by VALO Technologies. It shares practical network security engineering, risk, and compliance guidance for MSPs and the organizations they support.
Questions about your own environment?
VALO works with MSPs and the organizations they support on Cisco and Palo Alto network security engineering and assessments.
Schedule a conversation